ClipXDaemon: X11 Clipboard Hijacker Via Bincrypter

**ClipXDaemon — Autonomous X11 Clipboard Hijacker:** This report analyzes ClipXDaemon, a Linux userland malware that is staged via a bincrypter-generated in-memory loader and dropper, persists via ~/.profile, daemonizes and masquerades as a kernel worker, polls the X11 clipboard every ~200ms, and replaces matched cryptocurrency addresses with attacker-controlled wallets entirely offline (no C2).